The NIS2 directive widened Europe's cybersecurity net from a few hundred operators to tens of thousands of "essential and important entities" — and it moved liability upward: management bodies must approve cybersecurity risk measures and can be held personally accountable for gross negligence. That changes the AI conversation. An autonomous agent that reads tickets, drafts emails and calls APIs is not a productivity tool in NIS2 terms; it is part of your attack surface and your supply chain at once.
Three questions your NIS2 auditor will ask about AI
- Who authorised this agent, and to do what? A prompt is not an authorisation. You need a durable record of which tools an agent may call, with what budget, in which scope — and proof it cannot exceed that authority.
- What happens when it is compromised? Prompt injection is the supply-chain attack of the AI era. Article 21 expects documented measures against exactly this class of incident — and evidence that a hijacked input cannot become a hijacked action.
- Can you show the trail? Incident reporting windows under NIS2 are brutal — early warning within 24 hours. If your AI activity is scattered across SaaS logs you do not control, you cannot reconstruct events in time.
The architectural answer
Governance that lives in policy documents fails these questions; governance that lives in the execution path passes them. Signed agent authority contracts enforced on every run, a two-gate defense that vets content and actions independently, default-deny egress on every connector, and an append-only audit ledger no administrator can rewrite — these turn NIS2 answers from an archaeology project into a database query.
The practical checklist
- Inventory every place an AI system can take an action, not just answer a question.
- Bind each agent to an explicit, revocable authority: tools, budget, scope, expiry.
- Demand fail-closed behaviour where safety is at stake, and truthful status when it is not enforcing.
- Keep the evidence inside your perimeter — the regulator will not accept "our vendor has the logs."
Related guides
Compliance
The EU AI Act Article 12 readiness guide
What record-keeping and human-oversight obligations actually require operationally from August 2026 — and the evidence an auditor will ask you to produce.
9 min read
Read the guide →Risk
The credentials nobody reviews
Your AI agents hold OAuth tokens, API keys and service accounts that went through no approval process. The agent was reviewed. The studio was reviewed. The identity behind them was not.
5 min read
Read the guide →Security
When the agents organised themselves: what the Hugging Face swarm means for accountability
Roughly 700 AI agents divided labour, traded favours and compromised production infrastructure across four regions. The uncomfortable part is not that it happened — it is that the account of what happened had to be reconstructed afterwards, by outside parties.
6 min read
Read the analysis →